Law No. 93/2021, published on 20 December 2021, establishes the general regime for the protection of whistleblowers, transposing into national law Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law, namely, public procurement, financial interests, money laundering and terrorist financing, internal market rules, consumer protection, protection of privacy, personal data and information systems, violent and highly organized crime and economic and financial crime.  

This diploma establishes the definition of whistleblower as well as the conditions for their protection.

With regard to the means of whistleblowing, the law provides for a distinction between internal or external whistleblowing, identifying which means and channels apply in each case.

According to the law the whistleblower can only resort to external reporting channels under certain circumstances, namely, if:

a)     there is no internal whistleblowing channel; 

b)     the internal whistleblowing channel only accepts complaints from employees, and the whistleblower is not an employee

c)     the whistleblower has reasonable grounds to believe that the breach cannot be effectively known or resolved internally or that there is a risk of retaliation 

d)     the whistleblower has initially lodged an internal complaint without having been informed of the measures envisaged or taken following the complaint within the legally prescribed time limits; or 

e)     the breach is a criminal offence or an administrative offence punishable by a fine of more than EUR 50 000. 

It also establishes the obligation for legal persons to have internal reporting channels, including the State and other legal persons under public law, provided that they employ 50 or more workers.

In accordance with this Law, the whistleblowing channels allow, namely, the presentation of complaints, anonymously or with identification of the whistleblower, made in writing and/or verbally, and the internal whistleblowing channel must guarantee the completeness, integrity and preservation of the complaint, the confidentiality of the identity or anonymity of the whistleblowers and the confidentiality of the identity of third parties mentioned in the complaint, as well as preventing access by unauthorized persons. 

Once the complaint has been lodged, the whistleblower shall be notified of its receipt within seven days and, within a maximum of three months from the date of receipt of the complaint, shall also be notified of the measures envisaged or adopted to deal with the complaint accompanied by the respective grounds.

Additionally, the following are common to both internal and external whistleblowing procedures: 

1. the guarantee of confidentiality of the whistleblower, where information that directly or indirectly allows the identity of the whistleblower to be deduced is included; 
2. the processing of personal data, including the exchange or transmission of personal data by the competent authorities, in compliance with General Data Protection Regulation, approved by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, in Law No. 58/2019 of 8 August; 
3. the conservation of complaints by means of a register of the complaints received, for a minimum period of five years.

Protection measures are also established in favor of the whistleblower, which include: (i) the prohibition of retaliation, including in a professional context and (ii) measures to support the whistleblower, namely legal protection.

The Law also establishes the terms of responsibility of the whistleblower, as well as the protection of the accused (person targeted).

Any rights or warranties arising hereunder may not be waived or limited by agreement.

Finally, the violation of the legal provisions for which the National Anti-Corruption Mechanism is responsible for processing and imposing fines may result in fines of between €500 and €125,000 for serious administrative offences and of between €1,000 and €250,000 for very serious administrative offences, depending on whether the offender is a natural or legal person.

This Law enters into force 180 days after its publication, on June 20^th , 2022.